EP2090952A2 - Hydraulic component control device and method for controlling hydraulic components - Google Patents

Abstract

The controlling method involves implementing a control function (23) in a microcontroller (22) which is provided in a control device (20). The control function controls the hydraulic components, where the control function is monitored with the help of a monitoring function (24) which is implemented in the microcontroller. The monitoring function is monitored by the control function. An independent claim is included for a hydraulic component control device.

Description

The invention relates to a hydraulic component control device and a method for controlling hydraulic components by means of a control device. Defects in hydraulic component controls, such as drive hydraulics and work hydraulics in mobile work machines, pose risks to the environment of the mobile work machines. Mobile work machines are, for example, construction machines, agricultural machines, or groundscare machines. For control units of such mobile machines, as for all machines with safety requirements, a risk analysis has to be carried out. The machine is subdivided into safety-related parts SRP / CS (safety-related part control system), whereby each SRP / CS has safety-related input signals and safety-related output signals. For each SRP / CS of the machine, a so-called performance level with regard to the safety requirements is defined in accordance with the standard "Safety of Machinery - Safety-Related Parts of Controls - Part 1: General Design Guidelines DIN EN ISO 13849-1: 2006" and then a safety category for set the safety-related part, which represents the adequate risk minimization.

Safety categories 3 or 4 require that a single fault in a system component that affects the safety function must not lead to the loss of the safety function. Any errors that result in the loss of the safety function must be detected within the time that the error can have a critical impact, the so-called fault tolerance time. In addition, a transfer of the system to a safe state must be guaranteed or the faults must be dealt with via effective external measures with regard to the electronic control system.

In the said standard, a two-channel architecture is proposed for category 3. The controlling logic units are provided multiple times and the calculations of the logic units compared with each other via a cross comparison. To provide multiple logic units, the amount of hardware required is increased, which also increases the unit cost of the machine.

In the DE 44 38 714 A1 With regard to a control of an internal combustion engine, it is described that three levels are provided in a microcomputer, a functional level, a monitoring level and a control level, wherein the functional level controls the internal combustion engine and the monitoring level monitors the activation. The control plane tests the memory elements and uses a watchdog to check the correct execution of the software function of the control plane.

The object of the invention is to provide a method for operating hydraulic components by means of a control unit, the high safety requirements especially with low requirements on the hardware of the controller is sufficient. Another object of the invention is to provide a hydraulic component control unit, with which even high safety requirements can be met with little circuit complexity.

According to the invention, this object is achieved by the subject matter of the independent patent claims. Advantageous developments of the invention are the subject of the dependent claims.

According to the invention, a method is provided for controlling hydraulic components by means of a control device, in which a control function for controlling the hydraulic components and a monitoring function mutually monitor each other.

As a result, requirements of safety category 3 or 4 can be met with a fairly simple software and hardware structure. In particular, there are no need for two processors for the different functions, i. the control function and the monitoring function are provided.

It is exploited that the standard DIN EN ISO 13849-1: 2006 according to Chapter 6.2.2 also permits other architectures than the proposed ones if the requirements of the category are met.

Since the control function is set up so that it also serves to monitor the monitoring function, both functions monitor each other so that individual errors of the monitoring function are detected. A conventional, Separately executed control function, which in turn monitors the monitoring function, can be saved.

In addition, a watchdog for monitoring the functions of the microcontroller can be provided, wherein the watchdog is preferably provided in a circuit outside of a processor of the microcontroller and receives its input and output signals from the monitoring function. The watchdog preferably has the ability to disable the power outputs of the controller 20. The provision of the watchdog outside the processor ensures that it can not be affected by processor errors. The fact that only the monitoring function triggers the watchdog simplifies the software concept. Continuous program execution on the microcontroller is only allowed with this concept if the monitoring function has been correctly called after checking by the control function and if the monitoring function detects the correct function of the control function and triggers the watchdog.

The watchdog is preferably designed so that a successful triggering requires the full function of the microcontroller. Thus, errors in the microcontroller lead to shutdowns of the control unit 20. According to a particularly preferred embodiment, triggering the watchdog includes that the monitoring function receives a request from the watchdog that, on the basis of the request, the monitoring function executes predetermined operations on the microcontroller and based on these operations Provides response, and that the watchdog compares the answer with an expected value. As a result, the monitoring function with respect to the watchdog after a proper functioning of the microcontroller.

In one embodiment, the monitoring function 24 are also supplied inputs for detecting state variables of the hydraulic components. Thus, not only the manipulated variables for the hydraulic components are controlled, but also subsequent links of the timing chain. This provides additional security, because thus both the incorrect specification of a manipulated variable by the control function and additional errors of the subsequent members of the electro-hydraulic timing chain can be detected.

In one embodiment, the control unit has a first shutdown device and a second shutdown device, both of which can be actuated independently of one another by the monitoring function or by the control function. The shutdown devices may e.g. a disconnect switch for a power supply of output power amplifiers, a reset mechanism of the microcontroller or a forced specification of a safe setpoint to the control function. The control function can also control the outputs to a safe manipulated variable, normally without current.

In one embodiment, a non-volatile data memory-for example an EEPROM memory or a flash memory-is protected as follows or checked by the monitoring function: The data memory is subdivided into data blocks, so-called pages. The data is stored on one page and stored a second time in a different form on a second page in the data memory, the so-called shadow page. When writing each calculated for the page and the shadow page a checksum and also stored.

Each time data is read from the data store, the data is compared between the page and the shadow page. The checksums of the page and the shadow page are also recalculated and compared with the stored checksums. In the case of a comparison error or a checksum error, the data is mutually restored depending on the error. If a restoration is not possible if several errors occur, an error message is generated and the entire system is transferred to a defined state. Preferably, the monitoring function performs check accesses to said nonvolatile data memory.

The hydraulic component control device according to the invention for drive hydraulics or working hydraulics of mobile machines is particularly advantageous. Such mobile machines regularly pose risks to their environment due to their size and powerful drives.

If the monitoring function and the control function call each other alternately, the call that was not made within a specific time can already be recognized as an error condition. This time is expediently the fault tolerance time within which an error does not yet have a critical effect. The detection of such an error condition occurs e.g. via a watchdog.

If the monitoring function accesses a memory area other than the control function, then a simple architecture exists in which errors can be easily detected by unforeseen memory accesses.

In one embodiment, the monitoring function performs the calculations for monitoring the control function two times each, the calculations being performed in different memory areas. This ensures that the probability of not detecting an error in the monitoring function decreases.

In addition, it can be provided that the monitoring function performs a checksum memory test of a memory area in which the program code u.A. the monitoring function or the control function are stored so that errors are detected quickly.

In one embodiment, the monitor function is called multiple times and at the beginning and end of each call, a checksum of its memory area is calculated. The checksum calculated at the beginning of a call is compared to the checksum calculated at the end of each previous call. Thus, it is checked whether the space provided for the monitoring function memory area has been overridden by other functions inadmissible.

Figur 1

zeigt den Aufbau eines erfindungsgemäßen Hydraulikkomponenten-Steuergeräts.

Figur 2

zeigt die Schritte eines Verfahrens zur Überwachung des Hydraulikkomponenten-Steuergeräts.

Embodiments of the invention are explained in more detail below with reference to the accompanying figures.

FIG. 1

shows the structure of a hydraulic component control device according to the invention.

FIG. 2

shows the steps of a method for monitoring the hydraulic component controller.

FIG. 1 shows the structure of a hydraulic component control device 20 according to the invention. In the application, a hydraulic component control unit 20, also referred to below as control unit 20, from Bosch Rexroth is used. The control unit 20 includes a microcontroller 22, a first shutdown device 25, a second shutdown device 26 and an external watchdog 27. The microcontroller 22 is a single-channel, therefore contains a processor 21. In the controller 20 in addition to the microcontroller 22 and a RAM Memory 29, a flash memory 35 and an EEPROM memory 36 each provided as individual components.

Within the microcontroller 22, the control function 23 and the monitoring function 24 are implemented as software programs. The control function 23 and the monitoring function 24 each receive the default signal 40, which controls the two functions from the outside. The control function 23 controls via the control signal 46, the hydraulic components 30, each having a drive or work function. The hydraulic components are, for example, hydraulic motors (hydraulic motors) or hydraulic pumps. The sensors 31 measure the state of the hydraulic components 30, for example their control pressure or their swivel angle. The corresponding measurement values are routed via the feedback signal line 45 to both the control function 23 and the monitoring function 24.

The monitoring function 24 is called at regular intervals by the control function 23 and checks the function of the control function 23. In addition, the monitoring function 24 also checks itself and the control function 23 also checks the function of the monitoring function 24. The control function 23 and the monitoring function 24 use the RAM Memory 29 as a working memory. There is a first memory area 29a, which only the control function 23 uses, while the second memory area 29b uses only the monitoring function 24. The monitoring function 24 is also referred to below as monitor 24.

The control function 23 and the monitoring function 24 have read access to the flash memory 35 only.

Since only one of the functions 23 and 24 accesses the first and second memory areas 29a and 29b in error-free operation, errors due to unauthorized memory accesses can be easily recognized.

The first shutdown device 25 is actively actuated by the control function 23 when the control function 23 detects an error. Accordingly, the second shutdown device 26 is actuated when the monitoring function 24 detects an error. The first shut-off device 25 and the second shut-off device 26 can each shell out the control unit 20. The watchdog 27 can also actively actuate the second shutdown device 26 in order to switch off the control device 20 or its actuating signal 46. Examples of such shutdown devices 25 and 26 are a central switch, ie a disconnect switch for the power supply of an output amplifier, various reset mechanisms of the microcontroller or a forced specification of a safe setpoint to the control function. The control function can also control the outputs to a safe manipulated variable, normally without current.

In the embodiment shown, the turn-off devices 25 and 26 are provided outside the microcontroller 22. Embodiments are also possible in which the turn-off devices 25 and 26 are provided in the microcontroller 22.

The external watchdog 27 is triggered by the monitor 24. This means that the monitor 24 outputs a trigger signal 42 at regular intervals. If the external watchdog 27 does not receive the trigger signal, it switches off the central switch of the control unit 20 within the fault tolerance time. In addition, a reset of the microcontroller 22 is preferably triggered after a further delay. This delay is provided to allow the control function 23 time to save the cause of the fault.

The central switch is a circuit breaker in the control unit 20, which switches off all power outputs of the control unit 20 at the same time. In addition, each output can be switched off individually. The outputs can only be switched on individually if the central switch is also switched on.

In addition to the external watchdog 27 is in the microcontroller 22, an internal watchdog 39, which also is triggered by the monitoring function 24 provided. The external watchdog 27 offers a higher level of security than the internal watchdog 39, since an error within the microcontroller 22 can also influence the internal watchdog 39.

For the controlled hydraulic components 30 of the mobile working machine, the risk analysis for some safety functions has yielded performance level d in accordance with the aforementioned standard DIN EN ISO 13849-1: 2006. This performance level is preferably represented by a structure corresponding to category 3.

Category 3 or 4 means that a single fault in a system component that influences the safety function must not lead to the loss of the safety function. Any errors that result in the loss of the safety function must be detected within the time that the error can be critical, and the system must be placed in a safe state, or the errors must be remedied by means of effective external measures. of the electronic control system.

The structure and function of the monitor 24 and its interaction with the control function 23 will be explained in more detail below.

The monitor 24 consists of a separate program part with separated from the addresses flash and RAM area. The monitor 24 monitors itself and the control function 23. In addition, the monitor 24 evaluates the results of self-test functions of the microcontroller 22. These are usually in a bios of the microcontroller 22 available. The monitor can switch off the control unit 20 via the external watchdog 27 or initiate other measures to bring the system into a safe state. The control function 23 monitors the monitor 24 and can also shut down the system in the event of an error.

The mutual monitoring of the monitor 24 and the control function 23 ensures that errors in one of the two functions are recognized in good time, even if they are not recognized within their own function. The division of the memory areas into those that can only be checked by the control function 23 and those that can only be checked by the monitoring function 24, as well as the extensive self-tests in the monitor 24 - as described in more detail later - and the use of a watchdog, the proper function of the microcontroller 22 cause that the Mirkokontroller 22 and the memory modules themselves need not be provided multi-channel. The monitor 24 is called regularly by the control function 23. The control function in turn waits for the correct execution of the monitoring function before further control values are calculated. This tests the accuracy of the monitoring function 24 at appropriate intervals, which is a requirement for category 3.

In FIG. 2 the call of the monitoring function 24 as well as the tests running therein are explained.

It is the FIG. 2 divided into four columns. One of the program run monitoring bits PLU of the control function 23 is shown in the first column. In the second column are the program steps of the control function 23, in the third column the program steps of the monitor 24 and in the right column the monitor enable bits SBFPF [1: 7] are drawn. As a first step, the program step Sx of the control function 23 is displayed, which calls the monitoring function 24 and thereby the first program step U1 of the monitoring function. During step Sx, program run watch bit PLU [0] is at zero and monitor enable bits SBFPF [1: 7] are all at zero.

When the monitor is called, the check is carried out in step U1 by means of the CRC 16 - checksum (CRC = cyclic redundancy check) of the first memory area 29b. It checks if the checksum is different from the checksum calculated at the end of the previous cycle. If the two CRC 16 checksums are equal, it is assumed that the content of the second memory area 29b has not been described inadmissible in the meantime.

If the checksums differ from the end of the last and the beginning of the current cycle, it is assumed that prohibited memory accesses have been carried out by other software parts, for example by interrupts or by the control function 23, or the memory area does not work properly on the hardware side.

It is also checked in step U1 whether the control function 23 has correctly reset the monitor enable bits SBFBF [1: 7] to zero. If these tests do not result in an error, bit 1 in the enable bit field SBFBF is set to 1.

In step U2, the RAM stuck to test and the coupling fault test are performed. If both indicate that there is no error, bit SBFBF [2] is set to 1. In addition, before setting an SBFBF bit, a check is made as to whether the bits to be set by the previously executed steps - here U1 - were actually set. Thus, the correct execution of the monitoring function 24 can be checked.

The second RAM memory area 29b used by the monitor 24 is grouped into structures. These structures perform a self-test before execution of the monitor 24 in each cycle. This test captures stuck-to errors and simple coupling errors between data and / or address lines. Stuck-to-errors are single failures in which a memory cell always outputs a fixed value, even if it was previously described with a different value. The stucco-to-test checks the RAM for expected values and checks them. This will also detect errors in the RAM accesses. Coupling errors lead to changes of several memory areas at the same time, if only it is intended to change individual memory areas. In order to test the monitoring function, errors are indicated, for example, during the commissioning test by an additional module via conditional compilation, which configures RAM areas via CAN bus irritation. These indexed errors are used to verify that the monitor detects the error.

In step U3, the logical program run monitoring of the application is performed.

In this step, it is checked if the PLU [0] flag is correctly set to zero. If so, bit PLU [0] and bit SBFBF [3] are each set to one.

In step U4, the flash memory in which the monitor 24 is implemented is tested.

The monitor 24 is located in a separate ROM section. This section is checked cyclically with a linear checksum for changes to the run-up. For reasons of runtime, only part of the checksum is calculated per cycle U1 to U9. After several cycles, the entire range is calculated - even within the error tolerance time - and the comparison with the checksum during startup can be performed.

The correctness of the Flash at startup would be checked by the BIOS via the CRC checksum check at system startup.

If no error occurred in step U4, the SBFBF [4] bit is set to 1.

The correct processing of CPU commands is checked via sample calculations with specified results. A cyclic CPU test is executed by the BIOS. The result of all BIOS internal tests is queried by the monitoring function 24.

In step U5, the monitoring functions of the 1st instance are performed. The monitor 24 calculates, among other things, independently of the control function 23, the control values to be output by the control function. Not only the electronic control functions to the actuator, but the entire drive train on the feedback of output signals such as speeds, hydraulic pressures in traction drive functions or angle checked at work hydraulics function. As a result, all sensor information available via the control function is included in the monitoring. By using the sensor information also in the control function itself, the availability of the signals is constantly testable and there are no increased unit costs for the representations of the safety function.

In step U6, the monitoring routines are performed on a second instance of the monitor 24. The application-specific safety functions are checked using two instances of this structure. The two are expected one after the other. The results are compared. In the calculation on the second instance, the same software routine is performed in the same hardware, but working on a different data set. The content of the data set is the same, therefore the same calculation result is expected. If this is not the case, it can be concluded that there is a corruption of one of the two data sets, e.g. through interrupts during execution and RAM overrides.

In step U7, the results from steps U1 to U6 are compared with expected values. Depending on the result of the comparison, defined measures are initiated and bit SBFBF [7] is set.

If a faulty condition has been detected by the monitor 24, a corresponding action is initiated. These Measures include the activation of the described defeat devices. In particular, the triggering of the external watchdog 27 is also omitted, as a result of which a reliable initiation of the disconnection or the establishment of a safe state is ensured.

The triggering of the watchdog 27 takes place in such a way that a proof of the proper functioning of the microcontroller 20 with respect to the watchdog 27 is provided. The monitoring function receives a request from the watchdog 27 to which it must respond in order to trigger. The provision of the response requires e.g. Computation operations on the processor 21, the query of input variables, a readout of the flash memory 35, etc. The watchdog checks the response and accepts the triggering if the answer corresponds to an expected value or range of values. Otherwise, the watchdog 27 brings about a safe state.

• Wesentliche Teile der Applikation sind ausgeführt worden. Das wird über die Freigabe-Flags PLU erfasst. Sie werden in der Applikation gesetzt, im Monitor 24 ausgewertet und zurückgesetzt. Das entspricht einer logischen Programmlaufüberwachung der Applikation durch den Monitor 24.
• Alle Selbstprüfungen des Monitors 24 sind positiv verlaufen. Erkannte Fehler werden nicht zurückgesetzt.
• Die Berechnung der Sicherheitsfunktionen im Monitor ergeben kein Fehlverhalten.

The following conditions must be met so that the monitor 24 does not switch off:

• Essential parts of the application have been executed. This is detected via the release flags PLU. They are set in the application, evaluated in monitor 24 and reset. This corresponds to a logical program run monitoring of the application by the monitor 24.
• All self-tests of the monitor 24 have been positive. Detected errors are not reset.
• The calculation of the safety functions in the monitor does not result in any malfunction.

Another reaction possibility is the issuing of a warning to the operator. If an error is detected, then the operator of the machine and / or the environment will be warned visually or acoustically. The operating instructions for the machine indicate how the operator has to react to warnings.

The monitor 24 may have higher priority than the control function 23, e.g. act on a speed setpoint of a diesel engine of a driven machine and reduce it.

In a hydraulic motor controlled by the control unit 20, the monitor 24 can reset the control value calculated by the control function such that the hydraulic motor pivots in the direction of the minimum pivoting angle.

As a further possibility of reaction, the interruption of the oil supply of the hydraulic system is provided, which takes place, for example, by a valve on the hydraulic block. This is usually relevant for working hydraulics.

In step U8, the internal watchdog 39 and the external watchdog 27 are triggered if it was found from the steps U1 to U7 that the initiation of a safe state is not necessary.

After the execution of the monitor 28, a CRC-16 check sum is again formed in step U9 via the content of the second memory 29b. Subsequently, the control function 23 is transferred again, which carries out the step S1. In this, it is checked whether the monitor 24 has completely set the enable bit field SRFBF to 1. Thus checked Also, the control function 23, the monitoring function 24, which increases the probability that errors are detected in the monitor 24.

As an example for the monitoring of a hydraulic component, the monitoring of an adjustable hydraulic motor is selected. On the hydraulic motor, on the one hand, the control signal, that is, the displacement, and on the other hand, the speed can be detected. Further, e.g. the state of a parking brake and the pressures available in the hydraulic system are detected. The speed of the hydraulic motor is influenced by the variables mentioned in a predictable way. First of all, the output actuating signal, namely the current for setting the swivel angle, is checked. Thus, the correct function of the control function 23 is detected. In addition, based on e.g. the speed of the reaction of the hydraulic motor checked on the control signals. Since the behavior of the swivel angle and speed depends on the aforementioned further measured variables, the function of the hydraulic system can be tested.

In order to reliably ensure the response of the hydraulic motor to the control function 23, the adjustment of the hydraulic motor in driving operation is repeatedly performed and checked.

To test the monitoring function 24, an offset is added to the measured actual control value or the hydraulic motor speed during the commissioning test by an additional module in order to provoke the error. By means of this indexed error it is checked whether the monitor 24 detects the error.

In general, a non-volatile data memory-for example an EEPROM memory or a flash memory-can be protected against errors or checked by the monitoring function as follows: The data memory is subdivided into data blocks, so-called pages. The data is stored on one page and stored a second time in a different form on a second page in the data memory, the so-called shadow page. When writing, a checksum is calculated for the page and the shadow page and also saved.

Each time data is read from the data store, the data is compared between the page and the shadow page. The checksums of the page and the shadow page are also recalculated and compared with the stored checksums. In the case of a comparison error or a checksum error, the data is mutually restored depending on the error. If a restoration is not possible if several errors occur, an error message is generated and the entire system is transferred to a defined state.

During operation, the monitoring function can perform test accesses to the said non-volatile data memory and thus test the absence of errors. The reading of the data from the nonvolatile data memory is accomplished, for example, by a function call. If, as described, errors occur or a data value can not be restored within the function call, the safe state of the system is initiated, for example, via the monitoring function.

LIST OF REFERENCE NUMBERS

20

control unit

21

processor

22

microcontroller

23

control function

24

monitoring function

25

first shutdown device

26

second shutdown device

27

external watchdog

29

RAM

29a

first storage area

29b

second memory area

30

Drive or work function

31

sensors

35

Flash memory

36

EEPROM

39

internal watchdog

40

default signals

45

Feedback signal line

46

actuating signal

Claims (19)

A method of controlling hydraulic components by means of a controller (20) comprising a microcontroller (22), the method comprising the steps of: - Controlling the hydraulic components by means of a in the microcontroller (22) implemented control function (23); - Monitoring the control function (23) by means of a microcontroller (22) implemented monitoring function (24); - Monitoring the monitoring function (24) by the control function (23). A method according to claim 1, characterized in that the monitoring function (24) and the control function (23) are called alternately and that a faulty call is mutually recognized. A method according to claim 1 or 2, characterized in that a next call of the monitoring function (24) by the control function (23) or a next call of the control function (23) by the monitoring function (24) of a result of the respective calling function (23, 24). Method according to one of claims 1 to 3, characterized in that , depending on a result of the monitoring steps, in particular upon detection of an error, a control of a safe state is enforced. Method according to one of Claims 1 to 4, characterized in that the monitoring step carried out by the monitoring function (24) comprises self-monitoring of the monitoring function (24). A method according to claim 5, characterized in that in a nonvolatile data memory, in particular an EEPROM, data are stored redundantly and are each secured by a checksum, and that when reading the data takes place a check on the basis of the checksum and / or redundancy, in particular, a correction of the output data takes place. Method according to one of Claims 1 to 6, characterized in that the monitoring function triggers a watchdog (27) as a function of a result of the monitoring step carried out by it. A method according to claim 7, characterized in that a repeated triggering of the watchdog requires an error-free operation of the microprocessor, wherein since a previous triggering at least the monitoring of the monitoring function by the control function and the monitoring step of the monitoring function were processed without finding an error. A method according to claim 7 or 8, characterized in that a triggering of the watchdog includes that the monitoring function receives a request from the watchdog that due to the request the Monitoring function on the microcontroller performs predetermined operations and provides a response based on these operations, and that the watchdog compares the answer with an expected value. Method according to one of claims 1 to 9, wherein the control device (20) has a memory (29) with a first memory area (29a) and a second memory area (29b), wherein the first memory area (29a) only by the control function (23). and wherein the second memory area (29b) is described only by the monitoring function (24). A method according to claim 10, characterized in that the monitoring function (24) performs a memory test of the first memory area (29a). Method according to one of claims 10 or 11, characterized in that the monitoring function (24) is called several times, and that at the beginning and at the end of a call in each case a checksum of the second memory area (29b) is calculated, the checksum, the beginning of a call is compared with the checksum calculated at the end of the respective previous call. Method according to one of claims 10 to 12, characterized in that the monitoring function (24) performs calculations for monitoring the control function (23) in each case twice, wherein the calculations are performed in different areas of the second memory area. A method according to claim 4, characterized in that the control of a safe state comprises one of the following steps, namely a shutdown of outputs of the controller (20), a reset of the microcontroller (22), an overwriting of a setpoint specification of the control function (23). Hydraulic component control unit for controlling hydraulic components, comprising a microcontroller (22) in which a software for carrying out the method according to one of claims 1 to 14 is provided. Hydraulic component control device according to claim 15, characterized in that a watchdog (27) for monitoring the functions of a processor (21) of the microcontroller (22) is provided, wherein the watchdog (27) is provided in a circuit outside the processor (21) and the watchdog (27) receives its input signals from the monitoring function (24). Hydraulic component control unit according to one of claims 15 or 16, characterized in that the monitoring function (24) inputs for detecting state variables of the hydraulic components (30) are supplied. Hydraulic component control unit according to one of claims 15 to 17, characterized in that a first shut-off device (25) and a second shut-off device (26) are provided, wherein these Shutdown devices (25, 26) are independently controllable by the monitoring function (24) and the control function (23). Use of a hydraulic component control device according to one of claims 15 to 18 for drive hydraulics or working hydraulics of mobile working machines.

Images